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31 October 1977 


MEMORANDUM FOR: Chairman, ICIS Task Force 

FROM: HHHH 

ICIS Task Force 
Logistics Representative 

SUBJECT: ICIS Discussion Topics (AIUO) 


1. (U) This memorandum is written to surface certain 

specific problems which I believe worthy of discussion during 
our deliberations. Problems are identified by brief titles 
heading paragraphs which include skeletal narrative explana- 
tions . 


2 . (U) Organization, Mission and Staffing of the 

Office of Logistics Security Staff (OL/SS) 

The Chief of the OL/SS has requested that the role jjjL 
and responsibility of his staff be reviewed to determine 
whether realignment of functions is in order. He also has 
recommended that his staff be augmented. His memorandum, 
along with a response from the Director of Logistics, is 
included for ICIS consideration as Attachment 1. 

3. (S) Staffing - OGC 

Mr. Blake has stated in paragraph 3(c) of his 
16 September 1977 memorandum that "Statistical analyses 
should be undertaken to validate if the distribution of man- 
power for the three functions involved in the three different 
modes is in consonance with the workload to be carried by each 
mode." There is a fourth function, i.e., Office of General 
Counsel, which is critical in all of the three modes. That 
office has assigned only two attorneys to review thousands of 
contract actions, as well as handle all other logistic^nro^^^ 
complicated large cases such as the flaps on 
As an example, the number of funded contrac^c^^W^^ 
reneweTin FY 1976 was 3,668, while unfunded actions totaled 
2,441. It should also be pointed out that procurement dollars 
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SUBJECT: ICIS Discussion Topics (AIUO) 


represented by these actions (even excluding national 
programs) represents one-half of the Agency's annual budget 
for other than personnel costs. The contract review by OGC 
is critical to insure that required clauses (security and 
other) are properly drawn and incorporated, and that the 
contract meets current legal and regulatory requirements. 

I believe a check with other agencies would reveal much 
greater allocation of resources to the function of legal 
support for the procurement function, and suggest that the 
application of manpower to the legal function may be a 
suitable subject for consideration if we are looking at 
the entire process. 

4 . (U ) Competition vs Security 

The writer has been involved with the IC Staff in 
preparation of a general policy statement on procurement 
which will be signed by the DCI and promulgated to the 
entire intelligence community. The statement emphasizes 
the importance of competition and broadening the base of 
industrial contractors used by the community. It also 
establishes reporting requirements directed toward facili- 
tating measurement of progress on objectives. The Admiral's 
emphasis on competition is being carried out in actions by 
the Agency Contract Review Board and by the various require- 
ments units. While agreeing that the DCI's objective is 
worthwhile and consistent with procurement law, there are 
certain attendant problems which must be considered: 

a. Adding a new contractor to the stable of J 

contractors, when compartmented clearances are 
required, requires dropping an equivalent number 
of clearances to be consistent with the Admiral's 
current direction. 


2 
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SUBJECT: ICIS Discussion Topics (AIUO) 


b. Competitions (which involve compartmented 
clearances) require involvement of several con- 
tractors and even providing the contractor a copy 
of the request for proposal or inviting them to a 
bidders conference requires establishment of new 
facility and personnel clearances and dropping of 
existing clearances. 

c. Directorate representatives sitting as 
members of the Agency Contract Review Board have 
stated that certain acquisitions have a level of 
sensitivity/classification which will not permit 
competition. A possible solution has been suggested 
to them, i.e., identification of such items and 
appropriate documentation to the DCI for Head of 
Agency approval to handle those specific actions 

on a sole-source basis. 

d. The emphasis on competition should also be 
considered as a part of the ICIS deliberation on 
paragraph 3(c) on staffing. The competitive process 
requires more time on the part of technical officers 
in preparation of specifications and statements of 
work as well as in establishing evaluation criteria 
and the actual process of evaluating contractor 
proposals. Time is required for holding meaningful 
discussions with contractors in the competitive 
range and additional effort is necessary on the 
part of cost analysts as they may be asked to 
examine proposals of all contractors in the com- 
petitive range. 

5. (U) Contract Numbering System 

The DD/S^T-DEG contracting team has surfaced a 
problem on the Agency's contract numbering system which it 
feels may tend to compromise Agency association classifica- / 
tion. The Office of Logistics has developed an interim P & 

solution to this problem; however, since the problem has 
been raised and is current, it is surfaced for ICIS infor- 
mation. Attachment 2 is the DD/S§T memorandum on this 
subj ect . 

3 
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SUBJECT: ICIS Discussion Topics (AIUO) 


6. (U) FOIA 


Many Agency contracts are written for which the 
association of CIA with the contracts is unclassified 
notwithstanding the fact that the contract may require 
work, reports and hardware which are Top Secret/Codeword. 
The schedule of such unclassified contracts must use 
certain language descriptive of the work to be performed. 
It also identifies the security classification of the work 
and provides information on contractor security require- 
ments. These contracts, as unclassified documents, must 
be provided upon request to any party making a request 
under the Freedom of Information Act. This is a problem 
in the sense that contractors doing highly classified 
work for CIA are easily targeted by the opposition. It 
even allows the opposition to prioritize its targets since 
Top Secret/Codeword projects will quite naturally be of 
greatest interest. 



7. (U) Contract Information Systems 

The DD/S^T has developed an automated system of 
storing and retrieving information on its contracts which 
is identified as STEPPES. This system includes all DD/S§T 
contracts including national programs which are compartmented 
in a file identified as SPA. The Office of Logistics also 
has developed a management information system which includes 
all Agency- funded contracts (not national programs). Much V j 

of the information in the two systems is duplicative; however,' 
the respective programs are significantly different as are 
the purposes of the systems. 

The lack of a single system for all contracts posed 
problems during the period when the Senate and House Committees 
were submitting frequent inquiries and prevents ready prepara- 
tion of reports on the total Agency procurement process. 


Attachments 

4 
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2 7 SEP 1977 


MEMORANDUM FOR: Chief, Procurement Management Staff, OL 

FROM: James H. McDonald 

Director of Logistics 

SUBJECT: ' Security 'Staff Augmentation and Role 

and Responsibilities of OL/SS 

REFERENCES: (a) Mult adsee memo dtd 16 Sept 77 fm 

A-DCI, subject: Comprehensive Review 
of Responsibilities for Industrial 
Contracts and Industrial Security 
COL 7 4256) 

(b) Memo dtd 22 Sept ,77 to A-DDCI fm 
A-DDA, subject - :. Comprehensive Reivew 
of Responsibilities for. Industrial 
Contracts and Industrial Security 

(OL 7 4256a) 

(c) Memo dtd 19 Sept 77 to D/L fm C/SS/OL, 

subject: Security Staff Augmentation 

(OL 7 4234) 


1. The Acting DCI, in referent (a), established the 
framework and principles for a survey of the industrial 
security and contracting function in this Agency. Referent (b) 
nominated you as the representative of OL. 

2. Referent (c) addresses a series of problems and 
conflicting roles and responsibilities from an industrial 
security standpoint. I am inclined to agree with Jerry that 
there are often conflicting responsibilities as well as ill- 
defined ones in this area. ,1 also agree that the creation 
of a 20-man industrial security audit team to review and 
monitor the work implemented by a much smaller security 
staff puts the cart before the horse. A better division 

of assets seems more desirable. 


OL 7 4361 
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SUBJECT: Security Staff Augmentation and Role and 

Responsibilities of OL/SS 


3. When the Survey Group is established and a chairman 
appointed, it is my desire that you present the viewpoint 
outlined in Jerry's memo to the group for its consideration 
and review before final recommendations are made. 


25X1 
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19 SEP 1977 ! 


MEiyJORANDUM FOR: Director of' Logistics 


SUBJECT: Security Staff Augmentation. (U) . : | - 


. 1. Action Requested : This memorandum contains a f :•:!&*>- * 

to commendation for your approval, : | - 

• 7 .: \ . •• _ 

2. Background : .(C) As a result of the Boyce-Lee case, ~ 
the focus of the Director of Central intelligence has centered 
on the Agency’s Industrial Security Program, The Director -of 
Security has deployed ad hoc security survey teams to conduct 
comprehensive inspections of certain industrial facilities for 
the purpose of determining whether the contractor is properly 
implementing the security measures pursuant to the obligations 
he undertakes when he accepts a classified contract, Paral- 
eling this effort the Office of Security is developing certain 
other measures designed to upgrade and strengthen security in 
the industrial area, i.e., polygraphing key contractor person- 
nel, establishing a Personnel Review Panel relative to indus- 
trial clearance cases, as well as establishing a permanent 
security audit branch. The latter group would replace the ad 
hoc survey teams. It is also understood that the DC I has 
approved the additional personnel which will allow the Office 
of Security to undertake these assignments. L 

The Director of Security has strongly Implied that 
the Agency security officer having cognizance over an indus- 
trial facility where discrepancies, are found shares a responsi- 
bility for the exigence of such a situation. Currently there 
are approximately contractors who cose within the purview 
of the Office of u5f?ftics Industrial Security Program, i Al- 
though the security classification of a majority of our con- 
tracts is at the Secret level, a significant number are at the 
Top Secret/Sensitive Comp artaen ted Information level. The 
professional resources available to assist in conducting and 
administering the Industrial Security Program amounts to four 

I • i 
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rofessionals at Headquarters 


teams. 


cers assigne 


3. Staff Position* (C) It is reasonable to assume the 
developments noted above will affect the operation of the; Indus- 
trial Security Program in several ways, ‘ 

Present staffing does not permit the inspection Of all 
contractors annually. It Is recognized that certain contractors 
due to the sensitivity of the work they are performing should be 
more closely monitored than present resources permit, p' 

The scrutinizing efforts of the Security Audit Group 
can only result in the Staff being tasked to both account, for as 
well as remedy deficiencies which may be uncovered. It would be 
preferable if 1:he Staff were in a position by more frequent 
contact with a contractor to ensure that security standards are 
being maintained and procedures were being properly complied ' 
with. It is not too inconceivable that- at some point the^ indus- 
trial security inspectors could be outdistanced (if not out- 
numbered) by the "checkers" once the Security Audit Program is 
■underway. t 

’ • . ... ... . . • •* ' . j. ' 

} The present Intense focus on contractor facility secu- 
rity acts to ignore another area of vital Importance in the " 
Industrial Security Program. Requiring equal attention although 
frequently overlooked, is the continued need for the services of 
knowledgeable industrial security officers at the Headquarters 
level who are responsive to Agency technical officers and con- 
tracting officers on security procedures relative to the various 
types of procurement actions. Clearly, the Industrial security 
coin is two-sided and both deserve our best efforts. 

A corollary consideration in the administration of the 
Indus trial Security Program are the problems present by indis- 
tinct channels for the command and control of personnel assets. 
^^as^ij^poin^ar^th^tw^SMS/DDSS^security officers located 

respectively, who 

exerc^^securit^controi^Jve^Agenc^eontractors where certain 
sensitive comp artmen ted information is involved. These officers 
have no reporting responsib^*t^t^this Staff. This situation 
is peculiar only to the|HHHH|HH| 

Perhaps a less exasperating problem but one which pre- 
sents some concern is the situation in the OD§E Contract Team, 


25X1 


Approved For Release 


r::ClAsRDP96B01172R00&700010001-4 


pu H* EJ 4 














Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 



Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 




Approved For Release 2001/1 ®j'5|| , -RDP96B01172R00070001 0001 -4 


3 November 1977 


MEMORANDUM FOR: ICIS Task Force Members 


FROM: 


SUBJECT: 


eputy in rector or Medical Services 

Study Material - Commercial Systems and 
Audit Division's (CSAD) Participation in 
the Procurement Process (A/IUO) 


(A/TUO ) Attached is a copy of the contribution of 
Office of Finance, in response to paragraphs 


3d, e, and f. As indicated i 


paper, CSAD's 


audit schedule for the six months ended 30 September 1977 
is available for study in my office in Room 1D4061, Headquarters, 
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ICIS TASK FORCE WORKING PAPER 

THE ROLE OF COMMERCIAL SYSTEMS & AUDIT DIVISION 
(CSAD) , OFFICE OF FINANCE IN THE AGENCY'S 
PROCUREMENT PROCESS 


1. (A/IUO) The Commercial Systems and Audit Division (CSAD) of 
the Office of Finance plays an important role in the day to day procure- 
ment processes of the Agency. This component of the Agency should not 
be confused with the Audit Staff of the Inspector General 's Office which 
is responsible for the post-audit of all Agency activities, including 

the procurement process. CSAD is a part of ongoing daily activities while 
the Audit Staff acts in an oversight capacity. 

2. (S) The major responsibility of CSAD is to assure that in 
cooperation with Agency contracting officers, the Agency gets the best 
possible goods and services at prices which are equitable both to contractors 
and the Agency. This involves major support to the contracting officers 

of the Procurement Division, Office of Logistics as well as to certain 
other contracting officers who have procurement teams in 0S0, ORD, ODE, 

DDI and OTS. Activities of CSAD and its auditors include (1) services prior 
to the award of contracts (2) field audits of contracts and (3) participation 
and cooperation in Office of Logistics procurement policy determinations. 

3. (A/IUO) The audit activities of CSAD are outlined briefly as 
follows: 

A. Services Prior to Award of Contracts 

1. Surveying Contractors' Internal Controls and 
Accounting Practices including a review of 
their Accounting Systems, Financial Position 
and Costing Practices. 
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2. Analyzing Contractors' Cost Proposals 

3. Providing Accounting Counsel to Contracting 
Officers 

4. Advising the Agency Contract Review Board on 
Proposals 

B. Field Audits of Contracts 

1. Reviewing Contract Documents 

2. Auditing Cost-type, Fixed Price Incentive 
and Fixed Price Redeterminable Contracts 

3. Auditing Overhead Expenses 

4. Providing Liaison with Defense Contract 
Audit Agency 

5. Providing Accounting Counsel to Contracting 
Officers on Contract Settlement 

C. Participating in Office of Logistics Activities by 

Attending Procurement Officers and Procurement Policy 

Panel Meetings 

25X1 


Approved For Release 2001/11/08-;^1 AtRDP96B01172R000700010001-4 





Approved For Release 2001/1 1/0^pf|BplP96B01172R00070001 0001 -4 

5. (U/AIUO) A recent development in government contracting is 
the formation of a Cost Accounting Standards Board which is chaired 
by the Comptroller General of the United States. As a result of the 
activities of the Board, most large contractors are required to submit 
comprehensive "Disclosure Statements" relative to their cost accounting 
systems. Consequently, CSAD is becoming more involved in policing the 
Cost Accounting Standards Board's promulgations and standards. This is 
requiring more audit time and will be [' . an area of expanding coverage 
for CSAD auditors. 

6. (U/AIUO) Another recent development in procurement is a 
"Truth in Negotiation" law which requires that when a negotiated contract 
exceeds $100,000 the contractor must be willing to make available to the 
contracting agency all the facts upon which it based its price quotation: 
Current law provides for audit of this data for the purpose of recovering 
any excessive profits r caused by the use of defective or inaccurate pricing 
data. CSAD is involved in this type audit because on occasion there may 
be a real "payoff" in following up on such contracts. 

7. (A/IUO) A further development which has occurred within the Agency 
is the determination that there will be greater competition in Agency 
procurement. In instances where "sole source" procurement was generally 
accepted we may now have two or three or more contractors submitting pro- 
posals which require analysis. 

8. (S) Two branches of the Commercial Systems and Audit Division 
provide support to the Office of Logistics in its procurement activities. 
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9. (U/AIU0) Auditors perform pre-award surveys for the purpose of 
assuring the contracting officer of the financial capability and responsi- 
bility of a proposed contractor and also to determine that the cost-accounting 
system of the contractor will appropriately accummulate the cost data required 
on a proposed contract. "Interim audits" (while contract performance is 

in progress) are performed when possible or necessary and "final audits" 
are performed prior to the final ccst or price determination and the closing 
of a contract. 

10. (S) During the year ended 30 September 1977, CSAD (exclusive 
of the auditors assigned to teams) completed the following: 

Financial and Accounting Systems Surveys 25X1/ 

Audits of Fixed Price Redeterminable and 
Incentive Contracts 

Interim Cost Audits 

Final Reports on Cost Type Contracts 

Overhead Determinations' 

Reviews of DCAA Determined Overhead Rates 

Analyses of Cost Proposals 

TOTAL REPORTS ISSUED 
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11. (S) As Of 30 September 1977 CSAD had on hand^^^|contracts 

orders total Unaudited 

I1A claims were approximately 

12. (U/AIUO) CSAD's audit schedule for the six months ended 30 
September 1977, which reveals the magnitude of the audit task, is on file 
in the Office of the Chairman of our Task Force. The schedule for the 
period 1 October 1977 to 31 March 1978 will be made available in the near 
future. 
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4 November 1977 


MEMORANDUM FOR: Chairman, ICIS Task Force 

FROM: tMHMM 

ICIS Task Force 
Logistics Representative 

SUBJECT: Paragraphs 3(d), (e) , and (f) of A-DCI 

Memorandum dtd 16 Sep 77, Subject: Com- 
prehensive Review of Responsibilities 
for Industrial Contracts and Industrial 
Security 


1. Specific paragraphs identified in the subject query 
whether the Directors of Logistics and Security, and the 
Chief of the Audit Staff: (a) maintain sufficient oversight, 

(b) have sufficient access to continuing information to make 
reasoned judgments, and (c) whether there exists sufficient 
on-site reviews, inspections and audits at Headquarters and 
field levels for functions for which they are held respon- 
sible by Agency regulations. This memorandum identifies the 
responsibilities for which the Director of Logistics is 
responsible (having to do with the three contracting modes) 
under CIA regulations and discusses existing overview, access 
and inspection. 

2. Headquarters Regulation ^^^H(Attachment 1) states 
that "The Director of Logistics v^^^^xercise all delegable 
procurement authority of the Director of Central Intelligence 
as otherwise specifically delegated by the Director." It 
goes on to state that such procurement will be accomplished 
in general conformity with the procedures and standards by 
which Federal procurement is conducted by the General Services 
Administration or the Department of Defense as evidenced 
respectively by the Federal Procurement Regulations (FPR) and 
the Armed Services Procurement Regulations (ASPR) as they now 
exist or may be amended. A revision to this HR, which is still 
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SUBJECT: Paragraphs 3(d), (e) , and (f) of A-DCI Memorandum 

dtd 16 Sep 77, Subject: Comprehensive Review of 
Responsibilities for Industrial Contracts and 
Industrial Security 


in coordination, will state that Agency procurement will be 
accomplished to the maximum practicable extent, in accordance 
with the ASPR except in those areas such as acquisition of 
ADPE, where the FPR is applicable for all Agencies. Copies 
of the ASPR are in the hands of all procurement units and 
Defense Procurement Circulars (DPC) , which provide current 
update to ASPR, are distributed to all procurement activities. 
Since the Procurement Division in Office of Logistics (OL) buys 
ADPE, that organization is the only unit maintaining a current 
FPR. Procurement Notes (copies provided to Chairman ICIS as 
Attachment 2) issued by the Director of Logistics (D/L) provide 
direction to the contracting activities on Agency procurement 
policy. Specific written delegation of procurement authority 
(available at various procurement activities and Procurement 
Management Staff (PMS) , OL) are issued to the chiefs of the 
various elements. 


25X1 


3. The principal of "management by exception" is basic 
to operation of the procurement activity with the several 
contracting elements executing their procurement responsibility 25X1 
autonomously in accordance with their delegation of procurement 
authority. The exception to this autonomity is that any 
procurement action or contract ammTdmeT^^xpected to be 

or more in value, and overruns ofj^^m^nd 15 percent must 25X1 
be reviewed by an Agency Contract Re^^^Boar^d^xh is advisory 
to the D/L and operates in accordance with HR Attachment 3) . 25X1 

This board does not review or challenge requirements established 
by technical officers but does review all aspects of the planned 
procurement in terms of good procurement practice and compliance 
with applicable laws and regulations. 

4. The D/L has also directed that the PMS/OL "Perform 
periodic review^or the D/L of the several decentralized con- 
tracting teams, HHH and the Procurement Division, OL." This 
direction is int^xfcxa in Logistics Instruction 1-15 (Attachment 
4) . The Agency Audit Staff reviews all contract team operations 
annually, and the results of these inspections are fed back to 
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SUBJECT: Paragraphs 3(d), (e) , and (£) of A-DCI Memorandum 

dtd 16 Sep 77, Subject: Comprehensive Review of 
Responsibilities for Industrial Contracts and 
Industrial Security 


the D/L. Additional checks and balances or reviews occur as 
representatives of the Logistics and Procurement Law Division 
of Office of General Counsel (OGC) review all contract actions, 
and representatives of the Commercial Systems and Audit Divi- 
sion (CSAD) of Office of Finance perform cost/price analyses 
and audit of proposals and contracts. While these functions 
are advisory to the contracting officers in the execution of 
his responsibilities, the CSAD reports through administrative 
channels any action of the contracting officer which ignores 
their recommendations and has negative impact on Government 
interest . 

5. The D/L is also charged by HR^^Hwith various respon- 25X1 
sibilities necessary for implementing an^ensuring adherence 

to the policy and standards pertaining to industrial contrac- 
tual arrangements established by the Director of Security 
(D/Sec). The Security Staff in OL and security representatives 
assigned to each of the decentralized contracting elements 
review contract actions expected to include classified elements 
to ensure compliance with D/Sec requirements. These security 
representatives, in addition to reviewing contracts and pro- 
viding advise and counsel to contracting officers, perform 
inspections of contractor facilities and maintain records of 
contractor facility and personnel clearances. 

6. An additional management tool utilized in management 
of contracts executed under the authority of delegations from 
the D/L is the OL Contract Information System (CONIF) . Data 
is input to this system with production reports issued to all 
contracting elements monthly which provide ready reference 

to contracting officers on important elements of the contract 
process . 

7. One important aspect of the overall Agency system is 
the fact that boiler plate contract clauses (mandatory ASPR 
and Agency clauses) are prepared by the PMS/OL in coordination 
with OGC which are included as a part of every contract and 
which may not be modified without approval. 
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SUBJECT: Paragraphs 3(d), (e) , and (£) of A-DCI Memorandum 

dtd 16 Sep 77, Subject: Comprehensive Review of 
Responsibilities for Industrial Contracts and 
Industrial Security 


8. In summary, the D/L believes that he does have 
sufficient oversight of the discharge of functions for which 
he is held responsible under Agency regulations. There is 
sufficient access to continuing information to make reasoned 
judgments as to how functions are being discharged, and there 
are sufficient on-site reviews, inspections, and audits. 

9. Noting the affirmative response in paragraph 8 above, 
it should also be noted that discussion in this paper refers 
only to two of the three modes which ICIS has been asked to 
consider. While the OL provides contracting officers to the 
contracting elements in the National Programs, it does not 
set procurement policy for those elements nor does it monitor 
in any way their performance. A discussion of the differences 
between the two systems of contracting is included in a paper 
entitled, "CIA Dual Delegation" which was prepared for sub- 
mittal to the Executive Advisory Group. That paper has 
previously been provided to you as Exhibit 6 to my memorandum 
dated 4 November 1977. 
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INSTRUCTION NO. 
LI 1-15 


AUminioinAitYt, 

IHTEHMAL USE ONLY 

LI 1-15 
ORGANIZATION 
Revised 1 March 1976 


SUBJECT: Mission and Functions, Procurement Management Staff, OL 


1. MISSION 

The Procurement Management Staff, Office of Logistics (PMS/OL) , 
shall assist the Director of Logistics (D/L) in discharging his 
responsibilities as the Agency senior procurement officer. This 
staff will serve as a policy, procedural, and coordinating 
mechanism on behalf of all Headquarters and field contracting 
TINTLunits having delegated authority from the D/L, will perform 
certain functions of a common -concern nature, will establish 

staff cognizance 


2. FUNCTIONS 



The Chief, PMS/OL, shall: 


a. Function as the principal staff officer to the D/L in all 
matters relating to those procurement functions which have been 
delegated to the D/L. This shall include the following: 



*(1) Serve as principal advisor and consultant to the 

Chairman, Agency Contract Review Board, and assume 
the duties of the chairman in his absence. Provide 
services as a secretariat to the Board. 


*(2) Serve as the senior Agency representative on all 
governmental and industrial committees concerned 
with procurement. 

(3) Prepare special studies, reports, and inquiries, 
as required by the D/L. 

(4) Serves as Agency principal representative to the 
Office of Federal Procurement Policy and act as 
focal point for all required interface. 
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Provide administrative oversight for those Agency pro- 
curement functions which have been delegated to the D/L 
and coordinate such other procurement functions as 
directed from time to time. These shall include the 
following: 

*(1) Serve as the Chairman, Procurement Policy Panel. 

* C 2 ) Interview and recommend potential candidates for in- 
clusion in the procurement career system. Serve as 
a member of the Logistics Career Service Board to 
develop recommendations on rankings of personnel, 
assignments, and training and review recommendations 
of subpanels . 

(3) Provide administrative support to the D/L and pro- 
curement officers by means of monthly statistical 
reports, special reports, and ad hoc inquiries based 
upon information contained in the CONIF procurement 
data bank. 

(4) Perform periodic reviews for the D^^of the several 
decentralized contracting teams , H^^Hnd the 
Procurement Division, OL . 

(5) Provid^adn^nistrative support and direction to the i=== ' 

Chief, who will report to the D/L via the Chief, 

PMS/OL. The Chief, PMS/OL , establish and maintain 

a coordinating role between and all Headquarters 

contracting teams and directorate elements associated 
with the procurement functions. 

(6) Develop and monitor the implementation of procedures 
and practices designed to increase the efficiency 

of the procurement system and procurement personnel. 

(7) Develop, manage, and administer "The Project Officer 
in the Contract Cycle" course. 

Exercise contracting officer authority on special programs, 
as directed by the D/L. 

Provide services of common concern to those elements of 
OL , the several decentralized contracting teams, and other 
Agency components concerned with procurement including 
the following: 
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(1) Provide a point of contact for contractors attempting 
to establish a business relationship with the Agency 
through the procurement process. 

(2) Act as the focal point for actions involving 

(a.) patents and rights - in-data arising from Agency 
contracts , 

(b) preparing and maintaining current contract general 
provisions, clauses, and forms, 

(c) reporting the overall status of Government- 
furnished property, 

(d) obtaining ratings under the priorities and 
allocations system, and priority assistance 
as requested, 

(e) processing contractor requests for access to the ' 
ASTIA (DOD) system, and 

(f) Agency compliance with Equal Employment 
Opportunity requirements in industrial contracts. 

(3) Develop and implement CONIF as a management information 
system^ including requirements and procedures, conduct 
of training courses, and preparation of manuals, etc. 

(4) Maintain and operate the D/L terminal utilized for the 
CONIF System. 

(5) Procure novelty searches for inventions claimed by 
Agency employees and pursue, as appropriate, the patent 
procedure through coordination with patent attorneys, 
the Patent Office, and the requesting component. 

(6) Administer and provide management support for training 
courses for technical personnel who are involved in 
the procurement process. 

(7) Review and analyze proposed and enacted legislative, 
executive, judicial, and administrative, requirements 
in the Federal procurement field to determine 
applicability to Agency procedures. 
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( 8 ) Review and recommend action on requests for 

approvals to contract with educational institutions 
and monitor compliance with Agency policy in this 
area. 

e,. Supervise and administer the Procurement Management Staff 
OL , as necessary. 

*Those functions identified in the previous sections with an 
asterisk shall be handled personally by the C/PMS and may 
not be delegated without the approval of the D/L. 



Director of Logistics 
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Aubrey - 


I hope the attached comments are useful to you. 

The only conclusion I can reach at this time is that the 
Audit Staff would require more auditors to do the work we think 
should be done. It is not feasible to guestimate a number at 
this time. The conclusions of the Task Force would have a direct 
bearing. 

With respect to recommendations, I think it would be pre- 
mature to make any. I would prefer to wait until the discussion 
phase is completed. 

I'll be back from my trip on Wednesday AM. If I can be of 
any help then, please call. 


Jerry 


r 
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3d 

The Audit Staff does not have sufficient resources to review 
the procurement processes to the extent we consider necessary. 

We previously reported our scope of audit. This paper identifies 
areas where we believe the audit processes should be strengthened. 

The list may not be complete. The task force may identify 
other areas where additional audit is required. 

1. Discuss and review technical evaluations with Contract 
Officer Technical Representative (COTR) t 

Note : This procedure has been followed in the past 

but only on a very few occasions. 

a. What homework has the COTR done to identify 
contractors in the field? Has the work been 
done before? Is another component actively 
engaged in a similar contract? 

b. Does the price proposed seem reasonable? 

c. Are there competitive proposals that can be 
used for comparison? 

d. Has the COTR reviewed the cost proposal by 
cost element? 

2. Review process of determination of adequacy of proposals. 

3. Review for duplication of effort. 

4. Review processes leading to determination of using 
Agency personnel vs. contracting out. 

5. Visit contractors to answer questions: 

a. Did technical direction contribute to the large 
number of changes? 
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b. To what extent were the changes-necessary to 
meet program objectives? 

c. Could the changes have been avoided? 

d. Was the Agency attempting to do more than was 
required? 

e. How do contractor personnel feel about type of 
contract negotiated? 

f. Would an administrative contracting officer placed 
at the plant have increased efficiency? 

g~. Are security procedures satisfactory? 

6. Determine degree of compliance with EEO requirements. 

7. Evaluate controls over GFE used in Agency and National 
Programs ? 

8. Determine extent of training in the contracting area. 

9. Coordinate audits of contracts containing GFE to 
Property Supply Office (PSO) records. National Pro- 
gram contracts do not specifically state what GFE will 
be furnished in most cases. There is usually a standard 
paragraph referring to the PSO. 

10. Review the cause (s) of overruns. 

11. Review for compliance with OSHA laws. 

12. Test and review the procedures related to potential 
conflicts of interest in the procurement processes. 

13. EDP Software. 

a. Review the need for the EDP software system 
development . 

(1) Examination of the feasibility study for 
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proper justification, cost estimates and 
approval . 

(2) Review hardware requirements for the pro- 
posed software system for cost, and the 
software impact on existing hardware. 

b. Examine the justification for using a contractor 
rather than doing the programming in-house. 

c. Define the problem in sufficient detail in the 
specification in order that the Request for 
Proposal can receive wide range of potential 
bidders . 

d. Review the monitoring by the technical officer 
during the progress of the contract. 

(1) Are contractor’s programming techniques 
structured or module. 

(2) What language is the contractor using? 

(3) Test contractor's results to insure that 
program meets core storage constraints, 

CPU time requirements, and program specifi- 
cations. 

(4) Document contractor software with programmer 
remarks, flow charts, systems design comments. 

e. Evaluate the test results of the newly developted 
software during simulation and parallel phase. 

14. EDP Hardware. 

a. Review the justification for acquiring by lease 
or purchase EDP hardware. 
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b. Examine the detail proposal submitted to vendors. 

c. Review the selection panel decision and justifi- 
cation for the hardware selected including the 
panel decision not to go through GSA. 

d. Review the test results performed by the con- 
tractor and the test conducted by the center 
personnel. This includes both bench test at 
the factory and the on-site testing. 

e. Evaluate the hardware impact on the software 
requirements and vice versa. 

f. Examine the cost estimates in the original pro- 
posals and the actual cost of acquiring the hard- 
ware. Determine if actual cost is in accordance 
with GSA schedules. 

g. Review management decision regarding the purchase 
of continued leasing of hardware, especially when 
the GSA procedures recommend procurement. 
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As previously reported, the Audit Staff has not been denied 
access to information. Nevertheless some comments are appropriate. 

Audit Staff is responsible for the audit of some major pro- 
grams. A few of the programs are so large as to suggest a need 
for continuous monitoring (by audit) rather than just a periodic 
review. The benefits to be derived from continuous monitoring 
include : 

- more timely opportunity to offer constructive 
comment 

- better audit scheduling to minimize inter- 
ference during critical operation periods 

- better allocation of audit resources. 

The need for continuous monitoring has been perceived but not 
pursued. The need has not been pursued primarily because of a 
lack of audit resources. 

There is an additional area relating to access of continuing 
information. The decision making processes in the Directorate for 
Science and Technology culminate in a quarterly review during which 
the DDS§T or his deputy give final approval before an action is 
initiated. Audit has very limited access to this process. There 
generally is little written material related to the process which 
is available for subsequent review by audit or other independent 
groups. Again the lack of audit resources has limited our pursuit 
of this matter. The process will warrant attention however as 
audit becomes increasingly concerned about program results. 


Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 


Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 


As previously reported, the General Accounting Office has 
identified three elements of audit, the third of which is con- 
cerned with results. The process calls for a determination 
whether the desired results or benefits are being achieved, 
whether the objectives established by the legislature or other 
authorizing body are being met, and whether the Agency has 
considered alternatives which might yield desired results at 
lower cost. Regardless of who audits for program results, 
the evidence should be available for review. 
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Audit experience to date indicates a need for on-site 
field reviews at the field level. Our experience in this area 
has been limited. But the results of our experience have been 
positive. Again, as we become more concerned with economy and 
efficiency and program results, the benefits to be derived from 
visits to contractor plants should become more manifest. 

Audit should become more aware of such things as the: 

- relationship between the Government and 
the contractor 

- extent of compliance with laws required 
of Government contractors but which are 

not examined for compliance by DCAA auditors 

- extent of compliance with industrial security 
practices . 
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4a 

Paragraph 4a can best be answered by Security. 

Audit does retain a responsibility to report the effec- 
tiveness of agreed upon industrial security procedures to 
management . 
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Audit is satisfied that there is a proper distribution of 
responsibility between the functions performed by the DCAA 
auditors and the Audit Staff. 

Audit Staff is concerned that many officials of the Agency 
do not understand the role of the two audit functions. To 
correct this situation, the Audit Staff conducts a continuing 
informal educational program. 

The Audit Staff in 1974 discussed the alternative means 
by which National Program Contracts could be audited. There 
have been no changes. The subject should be considered again. 

For many years there has been limited coordination between 
the Audit Staff and the DCAA auditors. Audit Staff reviewed 
DCAA reports. On occasion there has been some discussion on 
topics of mutual concern. On a few occasions the results of 
the liaison between the two audit groups resulted in cost savings 
to the Government. 

As both audit staffs apply greater resources to program 
results audits, the need for increased liaison will grow. 
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The Audit Staff is not in a position to document an answer 
to the question. There has never been an audit conducted to 
address the issue. Based on observations, however, the answer 
is no . 

The CONIF and STEPS system come closest to addressing the 
issue. But neither system was designed to enable the Agency 
to speak with one voice to the contractor. 
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ICIS TASK FORCE WORKING PAPERS 


OFFICE OF COMMUNICATIONS 


(C) Office of Communications’ responsibility for negotiating 


the establishment of communications facilities at Industrial 


Contractor sites is contained in HR 


Attachment A 


(C) There are currently ^HAgency sponsored communications 


centers located at Industrial Contractor sites. Cryptographic 


equipments and materials are provided and controlled by the 


Office of Communications in accordance with national policy 


direction of the United States Communications Security Board 


(USCSB) . Attachment B. The selection of equipment, installation 


criteria, area of control and security safeguards are the same 


as those prescribed for CIA staffed domestic communications 


centers . 


(C) New requirements to establish communications centers 


at contractor sites are received by OC from the sponsoring 


Agency component. The request specifies the type of communi- 


cations service required, the security level of material to be 


handled, cost center information, and the name and clearance 


status of contractor employees with whom OC will coordinate 


the installation. OC, in coordination with the Office of 


Security, conducts an initial site survey at the contractor 


facility to verify that suitable space is available to install 
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the communications center. Arrangements for any necessary 
structural renovations, power requirements and special security 
considerations are coordinated with appropriate contractor 
personnel during the initial site survey. The sponsoring 
Agency component is advised of the results of the survey and is 
provided a cost estimate covering communications equipment, 
circuitry, installation and related costs. 

(C) Contractor communications centers supporting joint 
CIA/NRO projects are managed by a small staff of OC personnel 
assigned to the Office of SIGINT Operations (0S0) , DDS§T . 

All operational, security, training, equipment installation 
and maintenance support is provided by that staff. Non-NRO 
related contractor communications centers receive similar 
operational, security, training and technical support from 

All 

contractor communications centers are provided a copy of 
OCHB 10.10.10 (KW-7 Operating Instructions) and a copy of 
OCHB 10.80.4 (COMSEC Material Control System). Attachment C. 
These documents are supplemented by procedural guides and 
message preparation instructions unique to a particular 
project or type of traffic being handled by the contractor 
center . 


2 
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(C) All contractor communications centers, with one 
exception, are staffed by personnel in the direct employ 
of the company involved. The personnel are selected by the 
contractor Security Officer and are subject to a background 
investigation conducted by OS. Cryptographic clearances are 
granted to contractor personnel based on a favorable OS 
background investigation and compliance with USCSB and CIA/0C 
policy. Office of Communications staff officers train 
contractor personnel in the operation and security implications 
of cryptographic equipments and in the use, control and 
destruction of cryptographic materials. Periodic and unannounced 
inspections are conducted at each contractor site to ensure 
compliance with security standards and to inventory cryptographic 
equipments and materials. 
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©Z, RESPONSIBILITltai 


The Director of Security has already set in motion programs designed 
to carry out his industrial security responsibilities. This interim 
report on industrial security t&BHHicaa was written^^rae^midst of a 
fluid security management situation. An Industrial Security Branch has 
been formed and has already begun to conduct security audits of contractor 
facilities, replacing the ad hoc security teams which had begun the audit 
program. As a matter of first priority it is f£KS& drafting a consolidated 
Industrial Security Manual. It will also act as an Office of Security 
focal point for providing advice and guidance to the Industrial Security 
Officers (ISO's) assigned to contracting components; establishing a formal 
training program for ISO's; and created a centralized reference index 
of security information on contractor facilities and contractorrpersonnel 
involved with all Agency contracting components. 


STATINT 



Security personnel in the industrial computer security field and 
'compartmented security policy and access control areas have been augmented. 

These additional security capabilities will obviously play an important 
role in industrial security and must be read into any assessment of the 
Agency Industrial Security Program as it now exists. 

A POLiCV STANDARDS awc| ^OCEDURES 

By regulation, the Director of Security has the function of developing 
and publishing uniform security policy and standards for the establishment 
and maintenance of the security of Agency industrial contract arrangements. 
He also has the regulatory function of providing security guidance to 
unspecified national intelligence programs. 

Security policy and standards for the contracting programs ^conducted 
by the Office of Logistics and by the contracting teams have been developed 
by the Security Staff of the Office of Logistics and published, after review 
and approval by the Director of Security, in the form of two industrial 
security manuals. The manuals are essentially the same, varying only in 
that one goes to contractors where association with the Agency is classified 
and one to contractors where it is not. Copies are given to contractors 
and incorporated into a contract by reference. 


j <poi~i <lV 
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Where Office of Logistics, contracting teams and national level 
programs enter into contracts involving SI/TKH material, they follow 
policy and standards developed by the Special Security Center of the 
Office of Security and published, after review and approval by the Director 
of Security, in an industrial security manual specifically tailored to 
Agency contracting. This manual is designed for the use of Agency 
employees. It is not given to contractors but pertinent portions may 
be furnished to contractors for their guidance and for inclusion in con- 
tracts where necessary. 


National level programs obtain the balance of their guidance con- 
_ cerning industrial secur ity policy and standards from the Special Security 
STATINT Center in the form of the^^^^^H n dustrial Security Manual which, after 
|_ review and approval by the Director of Security, was published in order 

t^establish guidelines, philosophy and requirements for safeguarding 

inf ormation in the possession of contractors. Copies of the manual 
BTATINTL are incorporated into contracts by reference. 


ind SI/TKH 


Underlying the physical security standards in the| 

manuals is the USIB Physical Security Standards Policy Statement which 
provides "minimum standards" applicable to contractors. A representative 
of the Director of Security served on the USIB committee which produced 
these standards. 


STATINTL 


At the present time, the manuals contain some discrepancies in 
standards or requirements but, more importantly, each manual contains 
language like the following: 

"Specific requirements . . . will vary from contractor to 
contractor . . . the proper combination of techniques and the 
degree to which they will be employed can best be determined 
during the . . . Security Representatives . . . visits and 
inspection .... There are, however, certain ... minimum 
standards which remain reasonably constant." 

This language obviously envisions permitting the Industrial Security 
Officer to make independent judgments on-site consonant with such consi- 
derations as cover. To the extent, however, that these judgments or 
tradeoffs vary from accepted standards they are reported to the appro- 
priate Program Security Desk or on to the Chief of the appropriate 
Security Staff along with a request for approval. They do not have to 
be reported to the Office of Security unless SI/TKH material is involved 
(where the Special Security Center must sign off), or where in the 
judgment of the respective security staffs, a significant policy question 
requires the attention of the Director of Security. 
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While only one of the three regulatory responsibilities given above 
contains the word "uniform", an attempt to achieve uniformity by means of 
a consolidated Industrial Security Manual is being undertaken by the newly 
created Industrial Security Branch as a matter of first priority levied 
by the Director of Security. 

VTINTL* PROCCDURES 



(2) Functions. The Director of Security will: 


IMINTL 


(b) obtain and evaluate through investigation, polygraph 
interview, and liaison contact with other United States agencies, 
pertinent information regarding personnel for employment, assign- 
ment or association with the Agency. 



(2) The Director of Security is responsible for: 

(c) Conducting security investigations and evaluations 
and furnishing the Director of Logistics with precontract and 
contract industrial security approvals. 


The standards for security investigation and evaluation for contractors 
involved with the Office of Logistics and the contracting teams are con- 
ATINTL tained in HR^^^Hwhile those for national program contractors and con- 
tractors in H^^nree modes where SI/TKH is involved are contained in 
DCID 1/14. While there are differences, they are not substantial and 
the Director of Security has prepared a formal guide for the Industrial 
Security Desk in the Clearance Division which brings the two standards 
into synchronization. (The Office of Security formerly had two completely 
ATINTL separate evaluation units to handle national programs and Office of 
Logistics requests.) 


(2) The Director of Security is responsible for: 

(b) assigning career security officers to the Office of 
Logistics and to directorates where contracting officers are 
assigned for duty. 



Prior to assignment to the Office of Logistics, contracting team, 
or national program, candidates for these positions are screened by Panels 
and the Office of Security Career Board (each of which contain officers 
who have served extensively in one or more of the three contracting 
modes) and nominees for assignment are sent to the Director of Security 
for his personal concurrence. 
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The key assignments that the Director of Security makes are the 
Chief, Logistics Security Staff and the Chief, OD&E Security Staff with 
the Chief /DDS&T Security Management Staff playing an important role at 
a different level. Carefully selected, highly experienced security 
officers, these individuals act for the Director of Security in implementing 
policy and making the industrial security system work. 

What formal reporting is required flows from the Industrial Security 
Officer to his component. Communications with the Director of Security 
consist of seeking guidance from or passing information to him on an 
incident or case-by-case basis. The interchange is flexible, fast and 
informal. As experienced officers, the Security Staff Chiefs can go to 
any portion of the Office of Security for appropriate guidance or go 
directly to the Director of Security. Conversely, the Director of Security 
confers directly with the Staff Chiefs when he wishes to give them guidance 
or obtain information. 

This same type of relationship exists between the Staff Chiefs and the 
Industrial Security Officers. Security advice and guidance is usually 
sought on a case-by-case basis and given in the same vein. 

The Industrial Security Officer is an active participant in the 
classified contracting team concept in all three modes. The more conversant 
he is with the technical aspects of his contracts, the more effective he can 
be in working up security plans and providing guidance. The relationships 
he creates with his contractors go a long way toward determining how much 
feedback and knowledge the contracting components and the Director of Security 
obtain regarding incipient or active security problems — it must be a 
carefully nurtured, professional relationship, establishing a working 
rapport of mutual problem solving. Once established, this relationship 
fills an informational and timliness need which no formal inspection system 
can ever provide. 

A formal training program for Industrial Security Officers will be 
activated by the newly established Industrial Security Branch. At this 
point in time, training is almost exclusively of the on-the-job variety 
given by experienced Industrial Security Officers. 

Fitness reports are prepared by the component in which the Industrial 
Security Officer serves. Promotions remain the province of the Director 
of Security as does rotation, although the latter is always in consulta- 
tion with the component involved. 



(a) Functions. The Director of Security will: 

(f) make necessary inspections, investigations- and reports to 
assure proper maintenance of security . . . 
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(2) The Director of Security is responsible for: 


(d) Performing physical security inspections when considered 
necessary, consistent with the primary inspection responsibility 
of the Director of Logistics .... 


In the Office of Logistics and contracting team areas, the Industrial 
Security Officers attempt to conduct annual inspections of those contractor 
facilities under their respective cognizance which possess or produce 
classified material. In the national programs, no formal inspection cycle 


is established, it being felt thatj given the manpower limitations^ the vvsrts 7 n 

g n H m -Jgaffdife of problem solvin^3^t?$£^h contractors and Industrial Security 


Security 


Officers provides reasonable oversight. All three modes feel that current 
manpower precludes conducting thorough, frequent inspections. 

MINTg, OVERS. SHT 


Function. The Director of Security will: 


(u) determine the effectiveness with which security programs 
and policies are being accomplished and institute or recommend , 
as appropriate, improvements where needed. 


The Director of Security does^.not have;=a ;formal,-.established'.feedback 
system? to tell him how everything is going. He does have an informal 
system which appears to work well in what is often called operational 
security. This usually starts with the contractor himself or the cogni- 
zant Industrial Security Officer. Flaps and serious policy problems of 
all sorts in physical, technical, and personnel security areas flow rapidly 
through the security network providing information and opportunity for 
the Director of Security to be aware of deviations, make reasoned judgments 
and reach timely decisions. The system is fast, flexible, free of protocol, 
and quick responding. 


It is at a level below this - the day to day decision making level - 
that the system lacks consistent oversight. Much of this type of informa- 
tion will be provided in a thorough manner, but at a much slower pace, 
by the new Industrial Security Branch in the course of security audits of 
sensitive contractor sites. Nothing, however, will provide a satisfactory 
substitute for active participation by the security offices directly involved 
in the contracting process. 


The Industrial Security Staff Chiefs and Desk Chiefs feel the need to 
get out more and observe the system in action. They feel more spot checks 
are needed. They feel constrained, however, by the need to be available 
to respond to Immediate needs as they arise. Much of this inability to 
participate more actively is attributed to a lack of manpower. This 
perceived lack may be caused by insufficient manpower investment within 
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the contracting components. It may be a result of inefficient work- 
load distribution and lack of interchangeability due to such things as 
necessary compartmentation, unnecessary compartmentation, cover, and physi- 
cal dispersal of officers who, if collocated, could pool office coverage 
and permit greater participation in on-site contractor security activities. 
It is probably a combination of both insufficient manpower and inefficient 
utilization of resources. 

Assessing this problem, determining an effective manpower level, 
recommending realignments or adjustment, and then, through adequate over- 
sight, continuing to test the validity of the industrial security program 
structure presents the primary security management challenge to both the 
Director of Security and the contracting components. 

EWPOR CJEM ejs)~r 


Under a delegation from the Director of Central Intelligence, the 
Contracting Officer is responsible for all aspects of contract adminis- 
tration, including enforcement of the contract provisions. In order for 
him to exercise this enforcement responsibility in the security portions 
of the contract the Contracting Officer must have knowlekble, continuing 
oversight of the contractor facility which will identify for him security 
policy deviations and procedural deficiencies. Since the Industrial 
Security Officer at the component procurement level and the Office of 
Security audit teams are in the best position to provide this oversight, 
the responsibility to do so should be clearly placed with the Director of 
Security. To meet this responsibility, the Director of Security will need 
clear regulatory recognition of an overall coordination responsibility for 
the Industrial Security effort. 

While this arrangement will not, literally, give prime responsibility 
over enforcement of security standards prescribed for CIA- contractors to the 
Director of Security, it will accomplish the desired goal by insuring 
adequate oversight over contractor security performance. All deviations 
and deficiencies would be noted, discussed with the contractor, recorded 
and forwarded to the responsible Contracting Officer for enforcement action. 
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II. RESPONSIBILITY 

A. Policy, Standards and Procedures 

The Director of Communications is responsible by regulations 
for negotiating the establishment of communications facilities at 
industrial contractor sites, in coordination with Agency components 
concerned. 

Cryptographic equipments and materials are provided to contractor 
facilities by the Office of Communications in accordance with national 
policy direction of the United States Communications Security Board 
(USCSB) . The selection of equipment, installation standards, area of 
control, and security safeguards are the same as those prescribed for 
Agency staffed domestic communications centers. 

All contractor communications centers, with one exception, are 
staffed by personnel in the direct employ of the contractor involved. 
Cryptographic clearances are granted to contractor personnel based on 
a favorable background investigation by the Office of Security and 
compliance with USCSB policy. Office of Communications staff officers 
train contractor personnel in the operation and security implications 
of cryptographic equipments and in the use, control, and destruction 
of cryptographic materials. All contractor communication centers are 
provided operational documents applicable to the particular crypto- 
graphic system and materials for which they are respon- 

sible. These documents are supplemented by procedural guides unique to 
a particular program or type of material being handled by the contractor 
center. 
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2 B. OVERSIGHT 

£ STATINT 

Management of contractor communications centers is shared by two staffs. 

Centers supporting Agency programs are managed by the 

with oversight by the Director of Communications. Centers 
supporting national programs are managed by the Communications Support Staff, 

Office of SIGINT Operations, DDS&T. An informal exchange of information 
exists between these 1 

caafee^s-s However, the Director of Communications does not have regulatory 
responsibility for of communications security o**»«esa!gfffc 

at centers supporting national programs. 

Periodic and unannounced inspections are conducted at all contractor 
sites to ensure compliance with communications security standards and to 
inventory cryptographic equipments and materials. Inspections are scheduled 
at intervals not to exceed six months. An interview is held with each of 
the contractor employees assigned communications duties and pertinent 
security requirements are reviewed. Any security deficiency that cannot 
be resolved during the visit is noted in the inspection report and prompt 
follow-up action is taken. 

Of primary concern to OC is the number of contractor personnel authorized 
access to cryptographic systems and materials. A recent decision to require 
the presence of two cryptographic cleared personnel during operation of the 
centers has required the granting of additional clearances. At the present 
time, ^Jcontractor personnel have access to Agency-sponsored contractor centers. 

OC has received approval of a plan to consolidate centers located in 
nearby areas and to provide message service to several contractors from one 
central location. Roving staff communicators working out of the consolidated 
centers will provide service, on a scheduled basis, to low volume contractor 
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centers within a 50-75 mile radius. staff communicator positions 

have been approved to man the consolidated centers and provide roving 
communicator coverage. A task force composed of OC, OS, 0S0, OD&E, OWI, 
and OSI personnel has been established to implement the plan. Implementation 
will be phased over a two-year period with a target date for completion by 
the end of FY-79. Once the plan is implemented, all contractor communi- 
cations centers will be under the direct control of Agency staff personnel. 


STATINT 


v 
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D. ORGANIZATION 

Industrial Security Officers (ISO's) are currently assigned to two major 
industrial security programs. One program involves Agency funded classified 
contracts and is under the technical purview of the Chief, Office of Logistics, 
Security Staff (C/OL/SS) with respect to advice, guidance and coordination. 

The other program involves non-Agency funded classified contracts and is 
under the purview of the Chief, Office of Development and Engineering, Security 
Staff (C/ODE/SS). 

To monitor the security of Agency funded contractual arrangements, the 


TINTL 


Director of Logistics has a Security Staff at Headquarters and a Security 


Officer 


In addition, activities of the 


Security Officers assigned to the decentralized contracting teams of the Office 
of Research and Development, Technical Service, SIGINT Operations, and the NFAC 
are under the technical security cognizance of the C/OL/SS. The ISO's monitor 
the security provisions written into Agency funded contracts. They receive 
their policy and procedural guidance from the C/OL/SS. 


The non-Agency funded program arrangement was formalized in 1962 by the 
establishment of the National Reconnaissance Office (NRO) which provides 


STATINT 



groups or projects report to the C/OD&E/SS but are located with and work for 
various project managers. One of these groups, the Development and Engineering 
Group (DEG) spends part of its time on Agency funded programs and part on non- 
Agency funded activities. All these individuals serve as ISO's as well as project 


and operational security officers. 
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There are who do the 

C/OL/SS or the C/OD&E/SS. These ISO's report directly to the Security Manage- 
ment Staff /DDS&T at Headquarters. There is no formal interface STATINTL 

the Officer or the 

with respect to the assignment of inspection responsibilities, the processing 
of personnel security approvals, or the submission of inspection reports. 

This unique situation should be corrected and is discussed further in the 

STATINT 

section of this report relating to Resources. 

A newly created Industrial Security Branch, with a T/0 of ^^^^^^^jpro- 
fessional security officers, will, by conducting periodic audits, provide the 
Director of Security and the contracting components with an independent 
evaluation of the security posture at all sensitive contractor sites. In 
addition, it will act as an Office of Security focal point for providing security 
advice and guidance to contracting components; establish an Industrial Security 
Officer's training program; and seek to establish uniform industrial security 
policies. However, this Branch will have no responsibility for the conduct of 

STATINT 

periodic inspections. 



With respect to the ISO's under the cognizance of the C/OL/SS, industrial 
security inspections of the contractor facilities are conducted and written 
reports submitted. Each of the Industrial Security Officers is allocated his 
own "stable" of contractors for which he has primary security inspection respon- 
sibility. 
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As a general rule, there is no duplication of visits to the same contractor 
facility. However, in certain instances, when special projects are involve 
exceptions may be made to the desired practice of having contractor interface 
with only one ISO relative to security policy matters. 

On the non-Agency funded programs, after the initial security requirements 
have been implemented by a contractor the ISO is in periodic contact with the 
contractor for the purpose of monitoring the security of the project and he 
periodically visits the contractor facility. However, in-depth physical and 
procedural security re-inspections are not generally undertaken and therefore 
no formal security inspection reports are submitted. 

All project ISO's in this program clearly recognize that periodic security 
inspection and the submission of formal inspection reports are desirable, 
however the day-to-day activity of handling the operational security require- 
ments of various projects precludes such re-inspection. Therefore the lack of 
manpower has precluded the initiation of a formal re- inspection program. 

At the larger and often most sensitive contractor sites various ISO's 
assigned to these programs, plus those assigned to the Agency funded programs 


visit the same contractor and levy security requirements relative to different 

STATINTU 

contractual arrangements. Currently there are^^BtSO's assigned to non-Agency 

■ STATINTU 

contractor facilities. Of the 


also have Agency funded programs 

STATINTU 


contractor facilities, approximately 
with ISO's who have separate contractual security responsibilities 

One cognizant Industrial Security Officer per contractor facility or two 
per contractor facility, representing the Agency-funded and national program 
interests, is highly desirable. 
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Finally, the current goal relative to inspection of contractor facilities 
is an annual visit for the purpose of conducting updated inspections or to close 
out contractors with whom contracts have been completed or settled. This annual 
re— inspection cannot be realized because of manpower constraints and corrective 
action with regard to the need for additional personnel is also discussed in 
relation to Resources. 
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Security Performance Standards 


Any examination of security performance by Agency contractors must 
begin with a review of performance standards and direction provided to 
the contractor. These standards and directions have their origin in 
security policy promulgated by the Director of Security through internal 
regulations incorporated in various security manuals and ultimately levied 
on the contractor thru the medium of the Agency's industrial contractor. 

Such direction may, in accordance with contract terms, also be givens 
orally by CIA Industrial Security Officers (ISO's) having cognizance for 
specific contracts or contractors. Discussion in this area requires that the 
overall role of the Office of Security with respect to the Agency's indus- 
trial security activity be considered as well as existing security practices 
for both Agency sponsored and national programs. 

reflect that the Director of Security is 
responsible for developing Agency policy and standards for the establishment 
and maintenance of security of Agency industrial contractual arrangements 
and that, consistent with the primary inspection responsibility of the 
Director of Logistics, the Office of Security will perform physical security 
inspections when deemed necessary. states that the Director STATINT 

of Logistics will implement and insure adherence to the security policy 
and standards for industrial contractual arrangements published by the 
Director of Security. (There is no reference, per se, to the role of the 
DDS&T to whom the DCI has given special procurement authority.) The Office 
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of Security: 

a. Assigns professional ISO’s to the two industrial 
security programs. 

b. Has established the criteria for the security approval 
of contractor employees. 

c. Conducts investigations and grants appropriate 
security approvals. 

d. Provides through the Special Security Center guidance 
relative to the establishment and accreditation of contractor 
SCI facilities. 

e. Provides a data bank of approved SCI facilities and 
personnel approved for SCI access. 

f. Provides through the Clearance Division a means for the 
certification of industrial security access approvals. 

Tro 

g. BJBtvides guidance relative to the security of 
computer operations through the Information Systems Security 
Group. 

Ao 

Howev&r, there is n o t -a focal point component within the Office of Security 
whose duties encompass the discharge of the Director of Security's responsi- 
bility to develop and publish Agency security policy and standards for the 
establishment and maintenance of Agency industrial contractual arrangements. 
In the absence of such a focal point in the Office of Security with the 
necessary authorities and expertise in the industrial security field, 
industrial security policy and standards are sometimes generated by the 
Security Staffs of OL and OD&E, somewhat of a "tail wagging the dog" 
arrangement. The more serious consequence of this practice is some lack 
of uniformity in standards and direction provided to our contractors. 
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Security policy and standards for Agency sjpwiiuuiuti programs have 


been developed by the Security Staff of the Office of Logistics and 


published, after review and approval, by the Director of Security, in the 


form of two industrial security manuals. The manuals are essentially 


the same, varying only in that one goes to contractors where association 


with the Agency is classified and one to contractors where it is not. 


Copies are given to contractors and incorporated by reference into a 


contract. 


Where Agency sponsored programs and national level programs enter into 


contracts involving SI/TKH material, they follow policy and standards 


developed by the Special Security Center of the Office of Security and 


published, after review and approval, by the Director of Security, in an 


industrial security manual specifically tailored to Agency contracting. 

« h ly 

This Sl/TKH manual is designed '^for the use of Agency employees. It is not 


given to contractors but pertinent portions may be furnished to contractors 


for their guidance and for inclusion in contracts where necessary. 


National level programs obtain the balance of their guidance con- 


cerning industrial security policy and standards from the Special 


STATINT 


Security Center in the form of the 


which, after review and approval by the Director of Security, was published 


in order to establish guidelines, philosophy and requirements for safe- 


guarding 


information in the possession of contractors. Copies of 


the manual, are incorporated into contracts by reference. 


Underlying ..the physical security standards in the 



and SI/TKH 


STATINT 


manuals is the USIB Physical Security Standards Policy Statement which 


provides "minimum standards" applicable to contractors. A representative 


of the Director of Security served on the USIB committee which produced 
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At the present time, the manuals contain some discrepancies in 
standards or requirements but, more importantly, each manual contains 
language like the following: 

"Specific requirements . . . will vary from contractor to 
contractor . . . the proper combination of techniques and the 
degree to which they will be employed can best be determined 
during the . . . Security Representatives . . . visits and 
inspection .... There are, however, certain ... minimum 
standards which remain reasonably constant." 

"Protection . . . can be accomplished in several ways by 
utilizing various security techniques and the degree to which 
theyjwill be emphasized can best be determined during . . . visits 
... by security officers representing acceptable standards which 
remain reasonably constant..." 


"There is no set formula for the physical protection of 
information 

The language quoted above envisions permitting the ISO's to make 
independent judgements on site consonant with such considerations as cover, 
but because of a lack of specificity, creates an obstacle to enforcement 
of contract terms. A further equally serious problem results when 
different security manuals are provided to one contractor. Mr. Lapham, 
Agency General Counsel, noted in his 12 August 1977 memorandum to the 
ADDCI that both the manuals entitled "Security Requirements for Contractors" 


and the 


used respectively for Agency 
Notwith- 


sponsored programs and national programs, were in use 
standing the fact that these two manuals are not alike in all respects, 
Iwith apparent Agency ISO acquiesence, elected to observe the 


M 
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requirements even in the performance of Agency contracts. 

The lack of uniformity in security standards and the fact that 
the Sl/TKH manual cannot be provided to contractors has been recognized 
and a uniform security manual suitable for incorporation by reference 
into classified contracts and distribution to contractors is in prepara- 
tion. 

Less than specific language heretofore included in various security 
standards has permitted a good deal of flexibility to ISO's in their 
administration of contractor security programs. Even with the new^ 
uniform, more specific single security manual it is envisioned that 
provisions must remain which allows ISO's to grant waivers or make changes 
as necessary for accomplishment of contract objectives. Such waiverjor 
changes should be reported in writing, to the Director of Security and 
reviewed on a continuing basis. 
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Resources 

For the purposes of this discussion the resources for administering 
the Agency Industrial Security Program fall primarily into two categories; 
those manpower and dollar resources required by the various Agency elements 
to properly administer an effective industrial security program at the 
contractor facilities, and those required by the contractors to 
effectively perform their security responsibilities. Before proceeding 
with a discussion of the impact of this additional security emphasis on 
resources, it is important to understand the current alignment of them, 
particularly in the manpower area. 

Current Industrial Security Command and Staff Relationships 

The two major industrial security programs, one involving Agency 
funded classified contractual activity which generally is under the 
technical purview of Chief, Logistics Security Staff with respect to 
advice, guidance and coordination; the other program involves non-Agency 
funded contractual activity which is under the purview of Chief, 

Office of Development and Engineering, Security Staff. 

The officers assigned to the two programs are professional security 
employees who provide industrial security support to Agency contracting 
offices, Agency technical representation, and representatives of the 
contractor. However, there are a number relative to policy and procedures 
in the two programs. 
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Office of Logistics, Security Staff 
The Office of Procurement and Supply, the predecessor of the Office 
of Logistics, formed a one man security staff in March of 1953 to provide 
industrial security support for classified procurement activity of this 
Agency. By 1956, the OL Security Staff (OL/SS) had expanded to five 
professional security career officers. An increase of the Agency's 


in 1961. In 1967 the Director of STATINT 
Logistics began implementation of a policy of decentralized procurement 
by establishing the first of a number of contracting teams composed 
of several contracting officers, an auditor and an ISO within various Agency 

H STATINT 


components. Today, the C/OL/SS has^^|lS0's assigned to his staff to 
provide security support to OL and to components not covered by contracting 


teams. In addition there are 


s assigned to contracting teams. 


The total professional manpower dedicated to this effort is (see 
attachment - Current Support of Agency Funded Contracts). 


STATINT 


Security Management Staff, O/DDS&T 
In the early 1960's resident security officers were assigned to a 
number of the Office of Scientific Intelligence (OSI) contractor facilities 
to monitor the security of external analysis SI/TK level projects. The 


continuing projects in this category are 


The security 


officers for these projects continued their assignment to OSI and responded 
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to the direction of the Headquarters OSI security officer until June 1970 

c 

V. 

when the latter's slot was abolished. Direction of these two security 
officers who are located 

as then assigned to the Chief, Security Management Staff 
(C/SMS/DDS&T) . Since that time, they have taken over the security 
responsibility for other Agency funded contractor facilities when SI/TK 
level activity is conducted. During this period, some of these projects 
were transferred from OSI to the Office of Weapons Intelligence (OWI) . 

In November 1976, both of these offices, OSI and OWI were transferred to 
the Intelligence Directorate, now NFAC. The current DDS&T manpower 
allocated to this effort is 2. '(see attachment - Current Support to Agency 
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Funded Contracts) 


A major portion of the additional manpower augmentation is for 


STATINT 


industrial Security Officers to be assigned to 


industrial 


security elements (Agency funded programs) and the Security Staff of 
ODE (non-Agency funded programs) . The proposed manpower resources for 
these activities are presented in Tables 1 and 2. These increases are 
absolutely essential if we are to administer an effective industrial security 
program which insures that the contractor is responding to our security 
standards and performance requirements. These increases will improve 
our day-to-day visibility into the contractor's security performance 
against the more comprehensive standards the contractor is being 
directed to enforce. 
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Increased espionage efforts in the U.S. of the Soviets and other 
foreign intelligence services has been a topic of constant discussion over 
the last few months. The revelations of the Boyce/Lee case and Presi- 
dential concern about the security of the U.S. telecommunications links 
have made it evident that a change in our industrial security posture 
is required. We can no longer just be concerned about physical personnel 
and document security but must take an aggressive approach in the areas 
of Counterintelligence and Audio Countermeasures. The D/OS should be 
instructed to proceed to develop and mount an ACM program and increase 
his liaison activities in the industrial Cl field with the FBI. It 
is estimated that a program for ACM inspection of ^^Jsensitive CIA and 
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Ither contractor facilities would 



the Bi-annual inspection of^^| 
cost : 

a. equipment 

b. travel 

c. personnel (&) 

Although the start-up cost in equipment for this effort is high, the 
potential for detecting or preventing a disaster worse than the Boyce/ 

Lee case is evident. 

We anticipate contractual cost increases as the contractors initiate 
improved enforcement of their industrial security responsibilities, parti- 
cularly during the implementing phase when they are bringing their 
facilities and security procedures up to a leveleconsistent with the more 
demanding security requirements we are imposing. This will, of course. 
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re sult in a moderate increase in the cost of goods and services in most 

instances, which must be borne by the sponsoring elements. The Agency's 

contracting authorities will insure that the contractor's charges for 

security performance continue to be reasonable. 

It is not possible to make accurate estimates of the level of these 
C&HTtlLfiCTtJfiL- 

added^costs until we have had an opportunity to study cost data submitted 

by contractors. As stated earlier, the added costs for increased 

security performance will be relatively high during the implementation phase, 

then stabilize at a lower level after existing deficiencies are corrected, 
f M /i.<r tg&j r* ! v*» d 

After the imp lomcmtaxy. phase we would not expect this added cost to 
exceed about 1% of the contract cost, although it should be pointed out 
that contract value is not necessarily a direct measure of security 
performance costs. 

We unanimously believe that the additional security protection 
afforded is adequate justification for the expenditure of the 
additional manpower and dollar resources involved. 



Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 



;ia 


Industrial Contracts 
and Industrial Security 


Final Report 


Prepared by the 

Task Force on Industrial Contracts 
and Industrial Security 


/ 

Handle via System Only 

ApproveffoBtelease 2001/11/08 : CIA-RDP96B01172R000700010001-4 


25X1 






